This setup assumes there’s already consensus on a certain set of validators, but the challenge is arriving at this consensus in the first place.
This is the general problem of proof-of-stake: it assumes the presence of consensus in order to arrive at consensus. This is because consensus is reached by utilizing the scarce resource that is the chain’s token, but without consensus in the first place this token isn’t scarce at all.
Proof-of-work uses something external to its chain as the scarce resource that determines consensus (energy), while proof-of-stake uses something internal to its chain (the chain’s token). This means that when a PoW chain forks, the two chains have to share the external resource, while the resource is copied for PoS chain forks.
The validator set changes as people bond or unbond coins in exchange for stake. Running a fair and secure initial distribution is a somewhat orthogonal problem; perhaps you can run an open auction. Any Proof-of-Work or Proof-of-Stake systems has issues with low security in the beginning. Consider that until late ~2012 the total hashrate of the Bitcoin network was less than the hashrate of a single Antminer S9.
> This is the general problem of proof-of-stake: it assumes the presence of consensus in order to arrive at consensus. This is because consensus is reached by utilizing the scarce resource that is the chain’s token, but without consensus in the first place this token isn’t scarce at all.
Consensus and scarcity are tightly related. The consensus process and protocol spec are what make the token scarce, since by definition the majority agree on the token's inflation rate, supply, block reward, etc.... What happens when validators try to fork and change these parameters? They are directly incentivized to do so, yet similarly, what happens when Bitcoin miners try to change the block reward? Of course, they don't hold all the power; with sufficient cause and collaboration, users can signal a user-activated soft fork, or simply choose to follow the original unmodified fork.
> Proof-of-work uses something external to its chain as the scarce resource that determines consensus (energy), while proof-of-stake uses something internal to its chain (the chain’s token). This means that when a PoW chain forks, the two chains have to share the external resource, while the resource is copied for PoS chain forks.
Yes, this is called the "nothing-at-stake" problem, and it is solved by punishing validators who equivocate. This enforces scarcity of voting power across forks. The point is they can't exercise their voting power on both chains. As soon as they vote on one fork, they are committed. The validators on the other fork are incentivized to delete their stake if they vote on the other fork simultaneously.
With PoW I can choose the 'longest' chain (chain with the most total work).
Or you could not do that. You could instead pick a different one. There is nothing stopping you.
If there are multiple networks, it would be obvious, and you can merely make up your own mind about which to follow.
Interestingly enough, this also applies to POW chains. There is nothing stopping you from picking a shorter chain. But if I had to guess, I would say that almost nobody would be following the shorter one.
This applies to POS coins as well. There would likely be 1 chain, that everyone is following. And this one chain would be obvious.
Is there a subtlety that makes that unworkable?
The reason this can’t work is because it has no cost to create a new chain from scratch. I can create a thousand valid PoS chains in virtually no time, and there’s no decentralized way for you to choose the one everyone else chooses.
The only way to solve this is to give special rights to some set of stakers.
I mean it’s been known about PoS systems since inception, it’s just funny how it’s supporters never like to admit it.
Proof of work committed to the chain that is valid according to consensus rules you know is universal and objective measure that everyone will observe equally.
That’s where bitcoin’s security comes from and that’s how you can avoid to rely on trusting third parties.
Hint: They don't exist. That's because the specification of the consensus rules are in the reference implementation of Bitcoin and every other implementation has to implement the same behavior as the C++ client, including any possible programming mistakes.
So you only know if your re-implementation works "correctly" if you download and run it against an opaque binary from an untrusted(?) source.
Whatever you do, you need to anchor your trust somewhere. You should always be aware where you anchor it and what trade-offs there are.
knowing consensus rules is the easy bit - code is open source, there are multiple implementations, there is community, there are users, merchants, exchanges - they all agree what consensus rules are. but what's most important - I CAN VALIDATE FULL BITCOIN BLOCKCHAIN IN REASONABLE AMOUNT OF TIME AND VERIFY THAT I FOLLOW THE CORRECT CHAIN.
you seem to have forgotten what this thread is about. it's a short one - i'm sure you can track back and read it again, carefully.
edit: clarification.
If you have multiple implementations that disagree how do you decide which one is the right one if there are also 2 competing blockchains available?
You said "You only need to know consensus rules. You can use any software, you can build it yourself, you can order an audit, you can write software yourself." and that's plain wrong.
You need to ensure you got the right consensus rules. This is not as easy as you put it.
Simply by understanding the hash function and difficulty, you can calculate the total work of any PoW blockchain. This provides some amount of trust that is very difficult to subvert. You only need to know the consensus rules if you want to be a miner on the chain.
VALIDATE THE FUCKING BLOCKCHAIN
what is so hard to grasp about this?
With Proof of Stake, you're trusting someone on the internet to tell you the hash for the most recent valid block.
And in practice the difference is even less significant. In reality, very close to every new user of a PoW blockchain just trusts the software distributor to be providing them with a client that works with the protocol commonly known as (Bitcoin-Cash, Ethereum, etc).
Knowing consensus rules I can verify the chain and if I notice something fishy - I go back to figuring out if I’m being attacked.
If instead I simply accept what chain I should follow - I have no guarantees I wasn’t attacked.
With PoS it’s even worse - I can generate million different chains for zero cost and you have no objective measure to tell which one of them is more genuine and more secure. That’s exactly the issue PoW solves - gives you such objective measure to compare chains.
The risk that the party you trust is defrauding you is infinitesimal in both cases, given you can poll the community widely until you settle a highly credible source of truth, or several credible sources that all agree on the same version of events.
>>That’s exactly the issue PoW solves - gives you such objective measure to compare chains.
That's true, with PoW you can measure the work in each chain. With PoS, you do you have a somewhat similar option: you can measure the market value of the coins of each chain.
no, nothing in PoS requires that. just a sad state of affairs with most centralized insecure PoS coins these days.
> With PoW, you only get the consensus rules.
no, you can opt to get hash of the most recent block if you want to compromise your security.
> Either way, you're relying on a trusted third party for bootstrapping.
no, you don't have to rely on trusted party for PoW bootstrapping. if you're scared somebody has communicated consensus rules to you incorrectly or maliciously - you just get those rules from multiple sources and VERIFY THE CHAIN FOR YOURSELF. with PoW you get objective measure to compare those chains, with PoS you get nothing.
> With PoS, you do you have a somewhat similar option: you can measure the market value of the coins of each chain.
no, you completely misunderstand the problem at hand. given coin X and multiple chains of coin X - how do you compare those chains?
market price of coin X tells you nothing how to distinguish between competing chains. market price is completely detached from actual verification work happening on chain.
It's necessary for bootstrapping. What alternative is there for bootstrapping using PoS?
>>just a sad state of affairs with most centralized insecure PoS coins these days.
I have no idea what superior alternative for PoS you're referring to. What bootstrapping alternative does any PoS blockchain have to getting the recent state and consensus rules from a trusted third party?
Right now your argument makes absolutely no sense to me as you suddenly seem to be implying that there is a superior PoS mechanism that existing PoS chains don't use, which is an entirely new argument you haven't touched on before and an have not detailed right now, so please elaborate on this with a mind to explain its connection to the argument thread that preceded it.
your claim was consensus rules AND hash of most recent block are necessary. this is false, hash of most recent block is not necessary for bootstrapping.
> your argument makes absolutely no sense to me so please elaborate
you have to be more specific. i've responded to every point of your message. if you don't understand something in my response - point that out.
A hash of A block from a trusted third party is needed for a node to bootstrap into a PoS network. Regardless of which block that is, the same amount of trust is required. And getting a more recent one reduces the number of blocks the node needs to download.
Anyway, the point is, the difference in bootrapping between PoW and PoS is in PoS, a hash of a block is also needed from a trusted third party. In both cases, a trusted third party is needed, and if the TTP is malicious, they can totally defraud the user.
so far so good...
> In both cases, a trusted third party is needed
wait, what? when did that thing sneak into your argument? why do i need trusted party for PoW?
But you don't know the consensus rules. How do you know that sha256 is the "real" bitcoin proof of work algorithm? Maybe the real POW algorithm is sha512?
You can't get around this bootstrapping problem.
the point is that when you choose consensus rules bootstrapping doesn't rely on third parties in bitcoin. it does in many other coins including ethereum.
There are no first principles where you derive everything from.
A person simply picks a chain to follow, it is their choice and their responsibility, in the same exact way that one chooses for consensus rules.
the two are not the same. consensus rules dictate how to validate the chain. following the chain without knowing the rules and validating it is meaningless. might as well trust any existing fiat system.
> There are no first principles where you derive everything from.
no, but there is an objective measure of security contributed to every chain - proof of work. by validating competing chains and measuring how much work they contain you can make informed decision. PoS has none of that, trusting chainstate from third party has none of that, only validating for yourself.
From the Cardano paper [1] p. 47,
> Even if the attacker could find a strategy to generate an alternative chain with valid leader selection data, presenting this chain and its blocks generated at slots that are far ahead of time would not result in a successful attack since those blocks far ahead of time would be rejected by the honest stakeholders and the final alternative chain would be shorter than the main chain.
At first glance, the attacker then needs to gain the keys for almost all of the bonded stake at some point in the past. This is obviously a stricter requirement than holding keys for 2/3+ of the stake at some point in the past, but still seems remotely plausible when targeting the small set of validators in the early bootstrapping period. Remember also that these early validators could be totally cashed out of the system and thus have actually have no disincentive not to sell their keys.
Actually, even controlling only 2/3+ of some past stake, the attacker can likely grind on the randomness beacon outputs (since they control all the shares) to ensure his controlled keys have near 100% of the slots in the next epoch. Then the long range fork would be of a similar or possibly even greater length than the honest fork.
1. Assume we have some set of "validators" who control the global consensus process. They come to consensus on the current global state of the system. These validators are vaguely analogous to miners in Proof-of-Work consensus.
2. These validators have coins bonded as collateral in exchange for more voting power in the consensus process.
One key idea necessary for Proof-of-Stake is to punish Byzantine validators, i.e., those who deviate from the consensus protocol, by destroying their bonded stake. If you misbehave, then you lose some proportion of your collateral. Thus, validators have incentive for participation (from rewards and fees) and a _disincentive_ for malicious behavior.
This is in contrast to Proof-of-Work consensus, where there is no way to punish a specific miner that misbehaves--we cannot programmatically take away physical mining ASICs. Changing the Proof-of-Work function is only an absolute last resort as it unfairly punishes the other honest miners.
So what constitutes misbehavior? When can we confidently punish another validator? An example is when a validator publishes signed attestations for conflicting forks--an example of equivocation. When presented with signed evidence of equivocation, the honest majority of validators can agree to punish the equivocator. This punishment system solves the original "nothing-at-stake" problem where a validator has no disincentive not to contribute to both sides of a fork.
On another note, the OP seems to misunderstand the fundamental consistency vs availability (in the event of a partition) trade-off that consensus algorithms must to make. Bitcoin's Proof-of-Work is more AP with probabilistic eventual consistency. In the event of a partition, the side with less mining power will make transactions unaware of the partition. When the partition heals, all transactions on the weaker side will revert, effectively double spending all transaction recipients on that side.
In contrast, many Proof-of-Stake protocols use a more traditional PBFT-style consensus process which favors consistency over availability. In the case of a partition, the weaker side will simply become unavailable (if it contains less than 1/3 of the voting power). In the event that no partition has >2/3+ of the voting power, the entire system will become unavailable. Also in contrast to PoW's eventual consistency, PBFT-style Proof-of-Stake allows for finality as soon as the validators come to consensus on the next block.